THE LARGE SIEVE AND GALOIS REPRESENTATIONS 



DAVID ZYWINA 



Abstract. We describe a generalization of the large sieve to situations where the underlying 
groups are nonabelian, and give several applications to the arithmetic of abelian varieties. In our 
applications, we sieve the set of primes via the system of representations arising from the Galois 
action on the torsion points of an abelian variety. The resulting upper bounds require explicit 
character sum calculations, with stronger results holding if one assumes the Generalized Riemann 
Hypothesis. 



1. Introduction 

1.1. Overview. In this paper, we explain how a sieve theoretic method called the large sieve can 
be suitably generalized to study various sequences of primes occurring in arithmetic geometry. 

In §1.2-1.4, we shall give some applications of our sieve (proofs can be found in §4-6). These 
examples can be read independently of the rest of the paper and make no explicit reference to sieve 
theory or Galois representations. Our choice of applications is not meant to be exhaustive but 
simply demonstrate a few basic problems that can be attacked with sieve theoretic methods. 

The large sieve is an important tool from analytic number theory (see [Bom74] and [Mon78] for 
background on the classical theory); our abstract form of the large sieve will be given in §2. The 
proof is similar to the classical version except one needs to be slightly careful since the underlying 
groups may not be abelian. E. Kowalski has independently come up with similar methods and has 
greatly generalized the large sieve (while adapting several of the ideas from this paper). The reader 
is strongly encouraged to look at his recently published book [Kow08], which nicely complements 
the material presented here. 

In §3, we will specialize to the case of sieving primes by conditions indexed by a collection of 
independent Galois representations. The proof requires estimating various character sums with 
stronger results being obtained if one assumes the Generalized Riemann Hypothesis. One of the 
merits of the large sieve is that these calculations need only be done once and we hope that 
Theorem 3.3 will be of practical use for others. 

Our applications will be proven in a common manner. We first express the problem in terms of 
an independent system of strictly compatible Galois representations; these Galois representations 
give constraints on the set of primes that we are interested in. The large sieve allows us to combine 
these constraints intelligently. The reader interested in applying the sieve can skip directly to §3. 

A quick remark is in order for analytic number theorists. By large sieve, we are referring to the 
sieve theoretic method of that name and not to the related inequalities. The large sieve inequalities 
in this paper are all proved in a very naive manner. Since the large sieve inequality deals with 
"on average" behaviour, one would hope to be able to prove stronger unconditional versions (due 
to the nonabelian nature of the our examples, it seems difficult to generalize the usual harmonic 
analysis arguments). It would be interesting if someone could make any major improvement on our 



Date: December 11, 2008. 

2000 Mathematics Subject Classification. Primary 11N35, Secondary 11G05, 11F80. 
Key words and phrases, large sieve, Galois representations, elliptic curves. 

1 



unconditional bounds. 



We now introduce some notation that will hold throughout (further notation and conventions 
can be found in §1.6). For a number field fc, denote its ring of integers by Ok- Let be the set 
of non-zero prime ideals of Ok- For each prime p G S^, we have a residue field Fp = O^/p whose 
cardinality we denote by N{p). Let Sfc(x) be the set of primes p in with A^(p) < x- 



1.2. Application: The Koblitz conjecture. Let E be an elliptic curve without complex mul- 
tiplication defined over a number field k. Let Se be the set of places of k for which E has bad 
reduction. For each p G — Se, denote the reduction of E modulo p by Ep. 

For all but finitely many p G — Se, reduction induces an injective homomorphism E{k)toj.s ^ 
Ep{¥p) and in particular |£'(/c)tors| divides |£'p(Fp)|. Define the integer 

tE,k = IcuiE' |£;'(A;)tors| 

where the E' vary over all elliptic curves over k that are A;-isogenous to E- The integer |£'p(Fp)| is 
a /c-isogeny invariant of E, so tE^k divides |-Ep(Fp)| for almost all p G — 5^;. We are led to the 
following generalization of a conjecture of Koblitz (see [Kob88, ZywOSa]). 

Conjecture 1.1. Let E be an elliptic curve over a number field k without complex multiplication. 
There is an explicit constant CE.k > such that 

PeM^) ■-= \{p e ^k{x) - Se ■- \Ep{¥p)\/tE,k is prime}] ~ Ce, 



(log x)2 
as X — > oo. 

Remark 1.2. There exists an elliptic curve E' /k isogenous to E over k such that |£''(A:)tors| = tE,k- 
Thus the conjecture can be restated in terms of counting the number of p such that the group 
-^p(^p)/-^'(^)tors has prime cardinality. The motivation for the conjecture comes from elliptic 
curve cryptography where the discrete logarithm problem for -E'(Fp) is hardest when the cardinality 
is divisible by large primes. There are no examples for which lim^^^oo PE,k{x) = oo has been proved. 

Conjecture 1.1 is given in [Kob88] under the assumptions that k = Q and tE,Q = 1. For heuristics 
and a description of the constant CE,k in Conjecture 1.1, see [ZywOSa]. The constant derived in 
[Kob88] is slightly different since it fails to take into account that the ^-adic representations coming 
from the Galois action on the torsion points of E need not be independent. The constant CE^k will 
be described explicitly in §4.2 since it naturally occurs in the proof of Theorem 1.3. 

Using the large sieve, we obtain the following upper bounds for PE,k{x)- 

Theorem 1.3. Let E he an elliptic curve without complex multiplication defined over a number 
field k. 

(i) Then 

X 



PE,k{x) < (24 + o(l))Cij,fc- 



(log x)(log log x) 

where the o(l) term depends on E/k- 
(ii) Assuming the Generalized Riemann Hypothesis ( GRH), 

X 



PE,k{x) < (22 + o{1))Ce, 



k- 



' (log x)^ ' 

where the o(l) term depends on E/k. 
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Remark 1.4. Suppose -E/Q is a non-CM elliptic curve with tE,Q = 1- In [Coj05], Cojocaru proves 
that Pe,q{x) <C 3;/(logx)^ assuming GRH^. The implicit constant depends on the conductor of E, 
but the exact dependency is not worked out. Cojocaru's bound is proved using the Selberg sieve. 

Unconditionally, Cojocaru proves Pe,q{x) <^ a;/((logx)(loglogloga;)). Though our uncondi- 
tional bound is stronger, it is still not good enough to prove the analogue of Brun's theorem 
concerning the convergence of the sum of the reciprocal of twin primes. More precisely, it is un- 
known whether the sum Xlp |£;p(Fp)| prime ^""^ convergent. Using our upper bound and partial 
summation, we are only able to show that the sum has very slow growth: 

E- ^ log log log X. 
P 

p<x,\Ep{¥p)\ prime 

1.3. Application: Elliptic curves and thin sets. 

1.3.1. Thin sets. We recall the notion of a thin set, for more details see [Ser92, §3] or [Ser97, §9]. 
Let n be a positive integer. 

Definition 1.5. A set C Q" = A"'(Q) is thin if there exists a variety X defined over Q and a 
morphism ir: X ^ Aq with the following properties: 

(i) n C 7r(A(Q)), 

(ii) The fibre of tt over the generic point of Aq is finite and tt has no rational section defined 
over Q. 

There are two special types of thin sets: 

Type 1: is contained in a proper closed subvariety of Aq. 

Type 2: $7 C tt{X{Q)) where X is an irreducible variety over Q of dimension n and vr: X — > 
Aq is a dominant morphism of degree d> 2. 

Every thin subset of is contained in a finite union of thin sets of Type 1 and Type 2. 

1.3.2. Bounds. Let E be an elliptic curve defined over a number field k. For each prime p G S^, 
let ap{E) be the corresponding trace of Frobenius. If E has good reduction at p, then ap{E) = 
N{p) + l-\Epi¥p)\. 

Theorem 1.6. Let Ei, . . . , En he elliptic curves without complex multiplication defined over a 
number field k and assume that the Ei are pairwise non-isogenous over k. Let Q be a thin subset 
ofz^+^. Then 

' x{\og logx)i+i/(9"+3) 
|{p G Sfc(x) : {ap{Ei),...,ap{En).N{p)) G n]\ « | (log x)i+V(i8n+6) 

^^i-i/(i4n+8)(iQg^)2/(7n+4) assumvug GRH. 

If Vt is a thin set of Type 1, then 

' x(log log x)2/(3«+l) (log log log 

|{p G Sfc(x) : (ap(^i),...,ap(S„),iV(p)) G ^}\ « < 



(logx)l+l/(3n+l) 
„l-l/(6n+2) 

assuming GRH. 



y (logx)l-2/(3'i+l) 



The implicit constants depend on the Ei, k, and 



-'^More precisely, Cojocaru needs only the 0-quasi GRH for some 1/2 < 6 < 1; i.e., no Dedekind zeta function has 
a zero with real part greater that 9. If we assume only the 9-quasi GRH, then our methods yield Theorem 1.3(ii) 
with 22 replaced by a larger constant depending on 9. 
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Remark 1.7. 

(i) Absorbing the extra factors, our theorem gives bounds of the form 3;/(log x)^"'"''' (and x^~^ 
under GRH) with exphcit values 7, 5 > 0. 

Note that while the implicit constant of Theorem 1.6 depends on the thin set Q, the 
function of x does not. It is natural to ask what the optimal function of x could be? The 
example of §1.5 suggests that the general bound is at best x^^^ /{logx). 

(ii) Theorem 1.6 was inspired by published remarks of Serre. Remark 2 of [Ser92, §3.6] states 
(but does not prove) the unconditional case of the theorem for a single elliptic curve de- 
fined over Q (and does not describe the exponent). A similar remark for the Lang- Trotter 
conjecture of Example 1.8 is given in [SerSl, §8.2 Remark 4]. 

(iii) Theorem 1.6 in the case of a thin set of Type 1 is not proven using the large sieve. In this 
case, instead of sieving by many primes it is better to sieve by a single well chosen prime. 

Let us consider a few special cases of Theorem 1.6. 

Example 1.8. Let E/Q be a non-CM elliptic curve and K an imaginary quadratic extension of Q. 
For each prime p of good reduction of E, let vr^ be the Frobenius endomorphism of Ep (it is a root 
of - ap{E)t + p). Define 

^e,k{x) = \{p < X : E has good reduction at p, Q{TTp) = K}\. 

The Lang-Trotter conjecture [LT76] predicts that there is a constant C > 0, depending on E and 
K, such that 

^1/2 
log X 

as j; — > 00 (another conjecture of Lang and Trotter will be described in §7). Let Dx be the 
discriminant of K and define 

17 = {(a, 6) G : - 46 = Dkc^ for some c G Q""}. 

Define X = Spec(Q[2;, y, z]/[x'^ — Ay — Dkz^)) and the morphism 

Tx: X ^ SpecQ[x,?/] = Aq, {x,y,z) ^ {x,y). 

The set C Q2 is thin of Type 2 since 0, C tt{X{Q)), X is irreducible of dimension 2, and vr 
is a dominant map of degree 2. We have IIe,k{x) = \{p < x : {ap{E),p) G VL}\ + 0(1), and by 
Theorem 1.6 

'x(loglogx)13/12/(logx)25/24 

^2i/22^jQg ^-j2/ii assuming GRH. 

Better bounds for this particular example can be found in [CD] or [ZywOSb]. 



^e,k{^) < 



Example 1.9. Let E and E' be non-CM elliptic curves over a number field k which are non-isogenous 
over k. Define the set = {(a, 6, c) G : a = 5} which is thin of Type 1. Theorem 1.6 becomes 



|{pGSfc(x):ap(E)=ap(^')}l«< 



' x(log log x ■ log log log x)^/^ 

assuming GRH. 



(logx)9/8 

^13/14 



, (logx)^/'^ 

This gives an explicit version of a theorem of Faltings which shows that the values ap{E) determine 
the isogeny class of E. (That such a theorem can be deduced is not surprising given that work of 
Faltings is needed in the proof to describe the image of the corresponding Galois representations.) 
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1.4. Application: Abelian varieties and Galois groups of characteristic polynomials. 

Definition 1.10. Fix a polynomial P{T) G Q[r]. The Galois group of P is defined to be Gal(P) := 
Gal(L/Q) where L is the splitting field of P{T) in a fixed algebraic closure Q of Q. 

1.4.1. Abelian varieties over finite fields. Let A be an abelian variety of dimension g defined over 
a finite field F with q elements. Let tta be the g-power Frobenius endomorphism of A. There is a 
unique polynomial Pa{T) £ Z[T] of degree 2g such that the isogeny r — tta oi A has degree PAi^) 
for r G Z. The polynomial PAiT) satisfies the functional equation, 

PA{q/T)/{q/TY = Pa{T)/T^. 

From the functional equation we find that if vr is a root of Pa{T), then so is q/ir. Let tti, . . . ,7r2r 
be the distinct non-rational roots of Pa{T) in Q; we may assume that they are numbered so that 
T^2i-iT^2i = q or {7r2i_i , 7r2i} = {±y^} for 1 < i < r. The Galois group Gal(PA(T)) acts on the 
roots of Pa{T) and induces an action on the r pairs {tti, 7r2}, . . . , {7r2r-i, t^2i-}- 

Definition 1.11. Let W2r be the group of permutations of {1, ... , 2r} which induce a permutation 
of the set {{1, 2}, {3, 4}, . . . ,{2r-l,2r}}. 

The numbering of the VTj's gives an injective homomorphism Gal(Pyi(T)) ^ W2r- In particular, 
we find that Gal{PAiT)) is isomorphic to a subgroup of W2g- Thus the largest possible Galois 
group for the polynomial Pa{T) is W2g- The group W2g has order 2^^! and is isomorphic to the 
Weyl group of Sp(2g'). 

1.4.2. Explicit Chavdarov. Fix an abelian variety A defined over a number field k and let 5^ C 

be the set of prime ideals for which A has bad reduction. For each p G — 5^, let Ap be the 

(n) 

abelian variety over Fp obtained by reduction modulo p. For an integer n > 1, let F^ ^ be the 

degree n field extension of Fp and let ^p x Fp"^ be the base extension of Ap by Fp"\ 
We define ILa to be the set of p G — 5a such that 

for some n > 1. The following result of Chavdarov [Cha97, Corollary 6.9] shows that Ha has 
natural density for certain abelian varieties. Define IIa{x) = Ha H 

Theorem 1.12 (Chavdarov). Let A be an abelian variety of dimension g defined over a number 
field k. Suppose that g is either 2, 6 or odd, and End^(j4) = Z. Then 

lim |nA(x)|/|Sfc(x)| = 0. 

X— >oo 

In other words, the primes p G — S'a for which Gal(P („)(T)) ^ W2q for all n > I, have 

^ yip X It p 

natural density 1. 



The following theorem, which will be proven with the large sieve, gives an explicit version of 
Chavdarov's theorem. 

Theorem 1.13. Let A be an abelian variety of dimension g defined over a number field k. Suppose 
that g is either 2, 6 or odd, and End^(^) = Z. Then 

x (log logs) 1+^(69^+39+3) 
\^a[x)\ < (log 2;) 1+1/(1292+69+6) ' 

and assuming the Generalized Riemann Hypothesis 

\IiA{x)\ « xl"l/(«^''+65+«)(logx)2/(4^?'+3<;+4)_ 

The implicit constants depend on A/k. 



Remark 1.14. 

(i) Theorem 1.13 can be used to bound the number of p for which is not geometrically 
simple. Fix a prime p G — (5" U 11^). For each n > 1, the polynomial P ^(n)(T) is 

irreducible since Gal(P. {n)(T)) = W2q acts transitively on its 2g roots. We also deduce 

Ap X It p ^ 

that Q(vr^p) = Q(vrAp) for all n>l. 

By [MW71, Theorem 8], for each n > 1 we have 

Endp(„)(^p)0zQ = QWJ 

and hence Endj^(„)(Ap) (Xiz Q = QIttaJ- We deduce that Endp^(^p) (8)z Q = Q(7rAp) and 
thus ^p/Fp is geometrically simple. We then have an inequality 

|{p G T,i:{x) — Sa ■ Ap not geometrically simple}] < |nA(a::)| 

and Theorem 1.13 gives an explicit upper bound. 

(ii) The dimension assumptions on the abelian varieties are needed only to invoke a theorem 
of Serre which says that Gal{k(A[i]) / k) = GSp2g(Z/£Z) for all sufficiently large primes £. 
This condition will hold for a "random" abelian variety A/k of any dimension g. See the 
recent paper of Hall [Hal08] which gives a nice sufficient condition to have Gal(k{A[i]) / k) = 
GSp2g(Z/£Z) for almost ah i. 

(iii) The majority of [Cha97] deals with the function field setting in which Galois representations 
can be identified with representations of etale fundamental groups. The large sieve method 
is applicable in this context as well and this has already been studied in a paper of Kowalski 
[Kow06] (see Chapter 8 of [Kow08]). The large sieve presented in this paper would need 
to be altered slightly to deal properly with both the arithmetic and geometric fundamental 
groups. In the function field setting one can prove strong unconditional bounds since one 
may use the full force of the Weil conjectures. 

1.5. An explanatory example. We shall now illustrate the basic concepts underlying the paper 
with a simple (but nontrivial!) example. The reader may safely skip ahead. 

Fix an elliptic curve E defined over Q and assume that E does not have complex multiplication. 
Let Se be the set of places of k for which E has bad reduction. For each prime p ^ Se, let ap{E) 
be the integer such that |£'p(Fp)| = p — ap{E) + 1 where Ep/¥p is the reduction of E at p. In this 
example, we will study the set 

A := {p ^ Se ■ CLp{E) is a square}. 

The set A is infinite (Elkies has shown that there are infinitely many p with ap{E) = [Elk87]). 
For each real number let A{x) be the set oi p & A with p < x. We will see that A has natural 
density zero; what is more interesting is to find explicit bounds for |^(x)|. 

Crude heuristics suggest that there is a constant C > 0, depending on E, such that 

3/4 

\A{x)\r.C- 

logx 

as X ^ oo. Proving anything like this is exceedingly difficult; we will focus on finding upper bounds 
for |^(a;)|. 

The basic idea is to study the integers ap{E) modulo several small primes i and then combine 
this local information to find an explicit upper bound for |^(x)|. To understand the distribution 
of the ap{E) modulo ^, it is advantageous to express everything in terms of Galois representations. 
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For each prime ^, let E[i] be the group of ^-torsion points in i?(Q). The absolute Galois group of 
Q naturally acts on E[i] giving a representation 



PE,i: Gal(Q/Q) ^ Aut(^[^]) ^ GL2(Z/«). 
From Serre (Theorem 3.5 with g = I), we know that there is a positive integer B such that 

(1.1) (n pE,e) (Gal(Q/Q)) = J] GL2(Z/«). 

Fix a prime I \ B and take any prime p ^ 5^; U {£}. The Galois representation p^; ^ is unramified 
at p, so we obtain a well-defined conjugacy class p£;^^(Frobp) of GL2(Z/£Z). The connection with 
the integer ap{E) is the congruence 

tr(/9£(Frobp)) = ap{E) mod 

Now take any prime p € ^(x) with p ^ I. Since ap{E) is a square, the trace of the Frobenius 
conjugacy class p£;^£(Frobp) is a square in Z/£Z. Therefore, 

P£;,^(Frobj,) C Ce := {A G GL2(Z/«) : tr(A) is a square in 

One readily checks that 

(12) = - + 

^ ' ' \Gl.2{'^/a)\ 2 

Let us now describe our example in a sieve theoretic fashion. Let Q = Q{x) be a positive function 
such that Q{x) <^ ^/x] we will make a specific choice later. Let A((5) be the set of primes I \ B 
with 1<Q. 

We now sieve the set Sq(x) — Se by the primes I G A((5). More precisely, for each i G A((5) we 
remove those primes p for which tr(/9£(Frobp)) G Z/^Z is a non-square. We are then left with the 
set 

y{x) = {pe Sq(x) - 5s : p = ^ or />£(FVobp)) C Q for ah £ G A(Q)}. 

The set y{x) contains A{x), so it suffices to consider upper bounds for \,y{x)\. 

Intuitively, the Chebotarev density theorem and (1.2) tell us that sieving Sq(x) — S'e by a prime 
I G A((5) will remove roughly half the elements, while (1.1) shows that our sieving conditions 
(indexed by the primes I G A((5)) are independent of each other. 

Let Q be a constant function. The Chebotarev density theorem gives us 

-^l^^4^^^(^o(l 

Since this holds for every constant Q, we find that the set A has natural density 0; i.e. 

lin, ^ = 0. 

X I log X 



In the same manner, we can apply effective versions of the Chebotarev density theorem (as in 
Appendix A) to obtain explicit upper bounds for |^(a;)|. However, the resulting bounds will be 
weaker that those coming from the sieve theoretic methods discussed in this paper. In particular, 
assuming the Generalized Riemann Hypothesis (GRH), they will not be strong enough to prove 
that there is a number 6 > such that |.4(rE)| <C x^~^ . 

This direct approach requires equidistribution of the conjugacy classes {(n^eA(Q) Pi)(^^^^p)}p 
the conjugacy classes of n£gA(Q) GL2(Z/iZ) (with respect to the measure induces by Haar measure). 
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The prime number theorem shows that the order of this group grows quickly as a function of Q, 



(1.3) |n,^^(Q)GL2(Z/«) =e'Q+o(Q), 

So in order for the Frobenius elements {iY\i^^Q)Pi)iFTohp)}p<x to be well equidistributed, we need 
the function Q{x) to grow quite slowly as a function of x. 

Let us now discuss what the large sieve method will give. (We will be applying the large sieve as 
in Theorem 3.3. The details are similar to those given in §4 for our application to a conjecture of 
Koblitz.) The advantage over the direct approach just given is that it allows one to limit the size 
of the groups considered. Let Z{Q) be the set of D C A{Q) such that H^gd ^ ^ Q ^'^^ define 



|C,|/|GL2(Z/£Z)| 



|Q|/|GL2(Z/ffl)| 

Using (1.2) one shows that L{Q) ^ Q. Assuming GRH, our large sieve will give the bound 

. ^, x/\ogx + Q^^x^^'^logx x/logx + Q^^x^/'^logx 

« m Q • 

Setting Q{x) = x^/^^/(log x)^/^^ (this choice makes the two terms in the numerator of our bound 
equal), we have 

^21/22 



\A{x)\ < \^{X)\ < 



(logx)9/ll' 

Unconditionally, with Q{x) ~ (log x/(log log x)^)-*^/^^, our large sieve will give 

I , x/logx a;(log log x)^/^^ 

^ ~L{QV ^ (logx)25/24 • 

An examination of the proof of the large sieve shows that in our example, we use equidistribution 
results only for the groups UieDuD' GL2(Z/«) with D,D' G Z{Q). For D,D' £ Z{Q), 

Iff GL2(Z/«)|<r[ £^<Q^ 

Thus to give a bound for |w4(x)| using the primes I G A(Q), the large sieve uses equidistribution 
for groups of size at most (this should be contrasted with (1.3)). 

1.6. Notation. For each field k, let k be an algebraic closure of k and let Qk ■= Gsd{k/k) be the 
absolute Galois group of k. 

Let L be a Galois extension of a number field k. For each p G that is unramified in L, let 
Frobp be the Frobenius conjugacy class of p in Gal(L/A;) (though the notation does not indicate it, 
the extension L will always be clear from context). 

Suppose that / and g are complex valued functions of a real variable x. By f <^ g {oi g ^ f), we 
shall mean that there are positive constants Ci and C2 such that for all x > Ci, |/(2;)| < C2\g{x)\. 
The dependence of the implied constants will not always be given but will be made precise in the 
statement of each of the main theorems. We shall use 0(/) to denote an unspecified function g 
with g <^ f. We shall write / = o{g) if g is nonzero for sufficiently large x and f{x)/g{x) ^ as 

X ^ CO. 

For X > 2, define the logarithmic integral Lix = J!^{[ogt)~^dt. The function Lix is useful when 
counting primes, and Lix = (1 + o(l))x/logx as x ^ 00. 

For a finite group G, the set of conjugacy classes of G will be denoted by G". We denote by 
Irr(G) the set of characters of G which come from irreducible linear representations of G over C. 



Let ( , ) be the inner product on the the space of complex-valued class functions of G for which 
Irr(G) is an orthonormal basis. For the basic notions of representation theory see [Ser77]. 
Finally, I and p will denote rational primes. 

Acknowledgments. Many thanks to Bjorn Poonen for his encouragement and assistance. Thanks 
also to Jeff Achter, Alina Cojocaru and Emmanuel Kowalski for their helpful suggestions. This 
research was supported by an NSERC postgraduate scholarship. 

2. A GENERAL LARGE SIEVE 

2.1. Setup and statement. Let X and A be finite sets. We will sieve subsets of X via conditions 
indexed by A. 

For each A G A, fix a finite group G\ and a map p\: X ^ G^. Let fi\ be the probability 
measure on induced by the counting (Haar) measure on G\. More concretely, we have fJ.x{U) = 

|Ga|~^ J2ceU 1^1 every subset U C g\. 

Consider a set ^ C A. The goal of our sieve is to find an upper bound for in terms of the 
values nxipxiy)). 

We now introduce some more notation. For each D C A, define the group Gd = Hagd ^'-'^ 
a subset E D, composition with the projection Go Ge induces an injective map 1tt{Ge) ^ 
lrr(G£))- We say that a character x S 1tt{Gd) is imprimitive if it comes from a character in Itt^Ge) 
for some proper subset E of D; otherwise we say that x is primitive. Let Prim(G£)) denote the set 
of primitive characters in Itt{Gd)- Define po '■= {Y[xeDP>^)- ~^ Finally, let V{A) be the 
set of all subsets of A. 

Theorem 2.1 (Large sieve). Fix notation as above, and let Z be a subset ofV{A). Let A(A, p, Z) > 
be the least real number for which the inequality 

2 



avXiPoiv)) 

vex 



< A{X,p,Z) Wv\ 

vex 



DeZ xePrimiGo) 

holds for every sequence {ay)y^x of complex numbers. 

Let y he a subset of X. For each X £ A, fix a real number < 5x ^ ^ such that 

(2.2) /Ua(pa(^)) < 6x. 

Define 

^(^) = E n 

DezxeD ^ 

Then 

L{Z)\y\<A{X,p,Z). 

Remark 2.2. 

(i) In classical versions of the large sieve, the groups Gx are abelian and the set A usually 
consists of prime numbers. Theorem 2.1 shows that the basic sieve theoretic principle 
underlying the large sieve can be fruitfully generalized. 

(ii) Note that A{X, p, Z) does not depend on the set =5^ and the dependency of L{Z) on J/' is 
only in terms of the 6x. 

(iii) An inequality of the form (2.1) is called a large sieve inequality. The study of such inequali- 
ties has been very important for analytic number theory (cf. [1K04, §7]). Quite often in the 
literature, the term "large sieve" refers to the study of large sieve type inequalities, even 
when no actual sieving is involved! 
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Proposition 2.3 below gives a very basic upper bound on A{X, p, Z). In the abelian case 
one can often prove stronger large sieve equalities using harmonic analysis, 
(iv) Theorem 2.1 can be further generalized but this version will more than suffice for our 
applications. For example, in the proof of Theorem 2.1 we do not explicitly need the group 
structure of the groups Gx. The main fact we need is that the characters ly:i{Gx) form an 
orthonormal basis for the Hilbert space of class functions on Gx- We refer to the Kowalski's 
book [Kow08] for further studies in this direction. 

Proposition 2.3. With notation as in Theorem 2.1, 



A{X,p,Z)< max E 



D'ez 

x'GPrim{Gj3/) -^62 xePrim(Gi3) 



E x{pd{v))x'{pd'{v)) 

vex 



A proof of the proposition can be found in §2.4. 



Remark 2.4. Thinking of the elements {pDuD'{v)}vex as being equidistributed in GJjuD' '^ith 
respect to the measure HagduD' ^a, we would expect the following expression to be small: 



1^1 ifx = x', 
otherwise. 



E xipDiv))x'ipD'{v)) 
The large sieve and Proposition 2.3 then gives an explicit bound of the form 

' ' - L{Z) 

where one can think of E{Z) as being an "error term". 

Taking Z = V{A), we find that L{Z) = UxeAi^ + (1 - h)/Sx) = (OagA '^a)"^- Thus the "main 
term" of our bound is \X\/L{V{A)) = (Oaga ^A)|-^|i i-e-, what one would naively expect after 
sieving X by independent conditions, indexed by A G A, each with probability 5x- Unfortunately, 
taking Z = V{A) in most applications will not be useful since the "error term" will be too large. 
The set Z is called the sieve support and should be chosen to optimize or simplify the bounds in a 
given application. 

2.2. The classical large sieve. As a simple example, let us show how the large sieve of Theorem 
2.1 relates to the familiar case of sieving integers. Fix a natural number N and real numbers M 
and Q > 2. Define the sets 

X = {n eZ : M <n < M + N} and A = {£ : £ prime and £ < Q}. 

For each £ € A, let Gi be the group 'Z/l'Z and let pe: X — > = Z/£Z be reduction modulo 
i. The set V{A) can be identified with the squarefree natural numbers whose prime factors have 
size at most Q (identify a squarefree natural number with the set of its prime divisors). For each 
d G 'P(A), Gd = Y[e\d^i ~ ^/^^ and pd is simply reduction modulo d. The irreducible characters 
of Gd = 'Ljd'L are those of form x i— > e^'^*'"^/'^ for a G 'L/d'L. The set Prim(G(i) consists of those 
characters with a G (Z/dZ)^. 

The classical choice for Z is the set {d G V{A) : d < Q}; the squarefree natural numbers less 
than or equal to Q. The following lemma shows that in the above setting, A{X, p, Z) < N + Q^; 
it is a consequence of [Bom74, Theoreme 4]. 

Lemma 2.5. For any sequence of complex numbers {an)n£X, 

E E |E««^'™^1^(^+^')Eki'- 

d<QaG(Z/(iZ)x neX n&X 
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In the present case, Theorem 2.1 speciahzes to the followmg famihar version of the large sieve. 



Theorem 2.6. Let 5^ he a set of integers contained in an interval of length N > 1. Let Q > 2 be a 
real number. For each prime i < Q, fix a number < (5^ < 1 such that \{n mod £ : n G < bgi. 
Then 

d<Q squarefree l\d 

2.3. Proof of Theorem 2.1. 
Lemma 2.7. For any D C A, we have 



n 



XePrim(GD) '"'^X 



xeD vex 

where (a^)^gx is any sequence of complex numbers such that = for all v £ X — . 

Proof. We proceed by induction on the cardinahty of the set D. 

• If \D\ = 0, then D = 9 and the lemma is trivial. Note that Prim(G0) = {!}. 

• If \D\ = 1, then D = {A} for some A G A. 

We first use the Cauchy-Schwarz inequality and our assumption that Oy = for v 



I J^a, 

v&X 



E E 



p\(y)=c 



< 



E \oi) ^ ± 



From (2.2) we have Ecep.(^0 1^' = /^a(/Oa(^))|Ga| < 5a|Ga|, so 



v&X 
Px{v)=C 



vex 



ceG 



E 

vex 



^ Px{v)=C 

■tt 



The characteristic function of a conjugacy class C G G\ in G\ has Fourier expansion 

\C\_ 
\G I 

Xelrr(GA) ^'"^ gee ' x6lrr(GA) ' ^' 

We now substitute this into our previous inequality and expand. 



E (|J^E^(^))>^= E 



x{C) ■ X- 



5a'|E°-I ^ i^^i E E °- 



vex 



E ^ E( E 



|Ga| 



X{C) ■ x{p\{v)) \ av 



l^^l E T?^ E E 



x{C)^{C)x{px{v))x'{px{v'))aym7 



E ( 1^ E \C\x{C)x:{C)) Y avX{px{v)) E ^v'X'ipxiv')) 



X,x'Glrr(G 



cgg» 



vex 



v'ex 



X,X'Glrr(GA) veX v'eX 
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Since the irreducible characters of G\ are orthonormal, 

I 1 2 I 2 I 2 I 1 2 

vex ^glrr(GA) v&X ^glrr(GA)-{l} veX veX 

The lemma for D = {A} follows by noting that Prim(GA) = Irr(GA) — {1} and collecting both sides; 
i.e., 

^-^|^a„| < ^ a^x{p\{v)) ■ 

vex xePrim(GA) neX 

• Suppose that \D\ > 2. Then D = E U E', where E and E' are disjoint proper subsets of D. We 
have a bijection 

Irr(G£;) X Irr(Gs/) ^ Irr(Gz)), ix,x') ^ Xx', 

where {xx'){9j g') = x{9)x{9') foi^ (9^9') ^ Ge x Ge' = Gd- This also induces a bijection between 
Prim(G£;) x Prim(G£;') and Prim(G£))- Using the inductive hypothesis for E and E' ^ we have: 

I 2 I 

X] \^o.vX{pd{v)) = ^ ^ \^a^a{pE{v))[3{pE'{v)) 

XePrim(GD) aGPrim(Gi3) /3ePrim(G£;/) veX 

XeE' ^ aePrim(GB) veX 

XeE' ^ XeE ^ vex xeD ^ vex 



> 



We now complete the proof of Theorem 2.1. Let (a^,)t,gx be a sequence of complex numbers with 
a„ = for V ^ 5^ . Using Lemma 2.7 and summing over all D & Z we obtain 

(En V^)|E«^r^E E \E-^xiPD{v))" 

DezxeD ^ vex Dez xePrimiGD) ^(^^ 

The large sieve inequality (2.1) then gives 

(2.3) (E n V^)|E«^r^^(^'/''^)Ei«^i'- 

DezxeD ^ vex vex 



In the special case where = 1 for v E we have 

DezxeD ^ 

The theorem follows by cancelling from both sides (the theorem is trivial if |=5^| = 0). 

Remark 2.8. Equation (2.3) can be useful in practice because it allows one to work with smoothed 
sums. We will not use this in the present paper. 

2.4. Duality principle. 

Lemma 2.9 (Duality principle). Let I and J be finite sets and let {cjj}jg/.jgj be a sequence of 
complex numbers. Then the following assertions concerning a real number A are equivalent: 

(i) For any sequence {xjjjg/ of complex numbers, 

ElE^'-i^^l^ < A^ixip. 

je.J iei iei 
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(ii) For any sequence {yj}j^j of complex numbers, 

i€i jeJ j&J 

Proof. This is a special case of [Mon78, Lemma 2]. □ 

Lemma 2.10. Let I and J be finite sets and let {cj.jjig/, jgj be a sequence of complex numbers. 
Then for any sequence {xjjjg/ of complex numbers, we have 

Proof. Take any sequence {yj}j£j of complex numbers. 

Y I Y = 5Z "^id^yiW 

— Y2 

jj'eJ i&i 



Xi I . 



yj\\y3'\ 
\y3? + \yr? 



2 

The lemma is now an immediate consequence of Lemma 2.9. □ 



Proof of Proposition 2.3. Define I := X and J := (J^jg^ Prim(Gi:)). For a character x ^ let 
be the element of Z for which x £ Pi'iin(Gi:)^). For v £ I and x^ define c^^^ := x{pD^{v))- The 
proposition then follows directly from Lemma 2.10. □ 

Remark 2.11. Let C = {cij) be an m x n matrix with complex entries. For a (not necessarily 
prime!) value p with 1 < p < oo, we can endow C" with the usual p-norm We then define 
||C||p to be the supremum of ||Cy||p/ ||y||p over all non-zero y £ C". In particular, note that ||C||2 is 
the smallest nonnegative number such that 

m Ti n 
i=l j=l j=l 

holds for all y G C". Lemma 2.9 is thus equivalent to ICfg = 1^*12 where C* is the conjugate 
transpose of C. For a complex matrix A, one has \\A\\^ = maxj \aij\. In particular, 



C*C\\^=mp^Y\Y^. 



Lemma 2.10 is thus equivalent to ||C||2 < ||C*C||^. 

3. The large sieve for Galois representations 
3.1. Galois representations. 

Definition 3.1. Let be a number field and let H he a (Hausdorff) topological group. A homo- 
morphism p: Qk H is a Galois representation of k if it is continuous (where Qk = Gal(A;/fc) is 
endowed with the KruU topology). 
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Let p: Qk — > -ff be a Galois representation. The group ker(/9) is a closed normal subgroup of 
Qk whose fixed field we denote by k{p). The representation p thus factors through an injective 
homomorphism Gdl{k{p)/k) ^ H. The representation p is unramified at a prime p E if p is 
unramified in the field extension k{p)/k. 

Fix a prime p G for which p is unramified at p and take any place *P of k{p) which extends p. 
Since p is unramified in k{p), we have a well-defined element /9(Frob(p) G H. The conjugacy class 
of /j(Frobip) in p{Qk) does not depend on the choice of *P and we shall denote it by /3(Frobp). 

Definition 3.2. Let {p\: Qk Hx}x^/^ be a collection of Galois representations. We say that the 
representations {px}\eA are independent if 

'n'°A)(efc)=n'°A(aA:). 

'AgA AgA 

An equivalent definition of independence is that the fields k[p\) are linearly disjoint over k. 
3.2. Statement of the large sieve. 

Theorem 3.3. Let F he a number field and let K he a set of nonzero ideals of Op which are 
pairwise relatively prime. Let k be a number field and suppose we have a collection of independent 
Galois representations 

{pa: Gk Hx}^^^. 

Assume that all the groups G\ := p\{Qk) ore finite and that there exists a real number r > 1 such 
that \G\\ < N{\Y for all hut finitely many A G A. Assume further that there is a finite set 5 C 
such that each p\ is unramified away from 5^ := ^ U {p G : p|A^(A)}. 

For every X A, fix a non-empty subset C\ of Gx that is stable under conjugation. Let Q = Q{x) 
he a positive function of a real variable x such that Q{x) <^ ^Jx and let A{Q) he the set o/ A G A 
with N{X) < Q. Define the set 

y{x) := {p G Sfc(x) : p G Sx or pA(Frobp) C Cx for all A G A(Q)}. 

Choose subsets Z[Q) C {D : D C A, Oag-D^^"^) — ^'^'^ define 

For each C A, define Gd = Hagd ^a- 

(i) Let B > be a real number. If Q{x) := c(logx/(loglog j;)^)"'^^^^^^ for a sufficiently small 
constant c > 0, then 

\y{x)\ < (Lix + 0(2;/(logx)i+^))L(Q)-i. 

(ii) Assuming the Generalized Riemann Hypothesis, 

|^(x)| < (^Lix + 0( max \Gd'\ ■ ^ \G^^\\Gd\ ■ x^^Hogx)^L{Qy\ 

(iii) Assuming Artin's Holomorphy Conjecture for the extensions k[p£)\j£,i) /k for D,D' G 2{Q) 
and assuming the Generalized Riemann Hypothesis, 

\y(x)\ < I Ux + 0( max x'(l) x(l) • 2;^/^ log x H L(Q)-^ 

The implicit constants depend on k, the representations {/5a}agA c-iT-d in part (i) also on r and B. 

14 



Remark 3.4. 

(i) If L{Q) = 0, then one should interpret the theorem as giving the trivial bound < 
+00. 

(ii) The dependence of the bounds in Theorem 3.3 on the sets C\ are only in terms of the ratios 
\Cx\/\Gx\- For each A G A, fix a real number <6x<l such that \Cx\/\Gx\ < Sx- Then 

Sx 



D&Z{Q)\&D ^ 

The smaller the values of 5x are, the stronger our bound on \^{x)\ is. The "large" in the 
large sieve refers to the fact that one may take 5x to be relatively small (at least smaller 
than earlier sieve methods); i.e., a large number of elements Gx are not hit by the conjugacy 
classes pA(Frobp). 

The example of §1.5 is typical of a large sieve where we have 5^ = 1/2 + 0(l/£). In our 
application to the Koblitz conjecture, we will have 6^ = {1 — 1/1) + 0(l/£^) which is typical 
of so-called "small sieves" . 

(iii) There is flexibility in what the set Z{Q) can be. The choice Z[Q) = {D : D C A, IlAeD ^i^) — 
Q} is usually appropriate, but as we will see other subtle choices may be useful. 

(iv) Suppose that s is a number such that \G\\ < A^(A)** for all but finitely many A G A (one can 
always take s = r). Assuming GRH, the bound in Theorem 3.3(ii) gives the simpler expres- 
sion |^(x)| < {Ux+0{Q^^+'+^x^/^ logx))L{Q)-\ ChoosingQ(x) = (xV2/(log2;)2)^/(2^+'+^\ 
we obtain the bound 

X I log X 



\y{x)\ < 



L(xV(4r+2s+2)/(log2;)2/(2r+s+l)) 



(v) In many arithmetic situations (including those considered in this paper) we have Gx ^ 
G{Of/X) where G is a group scheme of finite type over SpecOp. In Theorem 3.3, one can 
then take r to be any value greater than the dimension of G. 

3.3. Abelian varieties. We now recall some basic facts concerning Galois representations associ- 
ated to abelian varieties; these will supply us with interesting examples that satisfy the conditions 
of Theorem 3.3. In particular, these representations will be needed for our applications. 



Let A be an abelian variety of dimension g > 1 defined over a number field k. For each integer 
m > 1, the absolute Galois group of k acts on the m-torsion points A[m] of A(k) inducing a Galois 
representation 

PA,m: Qk ^ Aut(yl[m]) ^ GUg{'^/mZ). 

Let Sa be the set of p G for which A has bad reduction. The representation pA,m is unramified 
outside of 5^ U {p G : p|m}. For every prime ideal p G Sfc — Sa-, there is a unique polynomial 
Pa,{T) G Z[r] such that 

Pa^ (T) = det(r/ - pA,mi'Frohp)) mod m 

for all positive m with p fm. This agrees with the definition of PAp{T) given in §1.4.1. 

Now fix a polarization (p: A ^ A"^ . Gombining this polarization with the Weil pairing gives an 
alternating bilinear form Cm- A[m] x A[m] — > fim- For x,y £ A[m] and a G Qk, we have 

e.m{(Tx,ay) =a{em{x,y)) = em(x, y)^''''"^'') 

where Xk,m' Qk {'L/m'L)^ is the cyclotomic character of k modulo m. 
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Let GSp(^[m],em) be the group of C G Aut(£'[m]) for which there exists an m(C) E {'L/ml)'^ 
such that em{Cx,Cy) = em{x , y)^^'^^ for all x,y £ A[m]. Our Galois representation thus becomes 

PA,m - Qk GSp(A[m],em)- 

If m is relatively prime to the degree of (/), then the pairing Cm is non-degenerate. In this case, the 
isomorphism class of the pair {A[m\^em) depends only on g and m, and we denote the correspond- 
ing abstract group by GSp2g(Z/mZ). 

We now give some examples of abelian varieties for which we can describe the image of pA,m- 

Theorem 3.5 (Serre). Let A he an abelian variety of dimension g defined over a number field k. 
Suppose that the following hold: 

(i) End^-(^) = Z, 

(ii) g is either 2, 6, or an odd integer. 

Then pA,m{Qk) is a, subgroup o/ GSp(A[?7i], e^) whose index is bounded independent of m. In 
particular, there exists a positive integer B such that pA,m{Qk) — GSp2g(Z/mZ) for all m relatively 
prime to B. 

Proof. In the case of non-CM elliptic curves (i.e., g = 1), this is a well-known result of Serre [Ser72] 
(we may choose i;^ to be a principal polarization and then GSp(^[m], Cm) — GL2(Z/mZ)). 

In the general case, Theoreme 3 from the Resume des cours de 1985-1986 in [SerOO] implies that 
there is a S such that p^/ is surjective for all i \ B. For an overview of the proof, see the letters 
at the beginning of [SerOO] especially the one to Marie- France Vigneras. The theorem then follows 
from the group theoretic Lemmas 1 and 2 in Serre's letter to Vigneras. □ 

The following describes the image of the Galois representations when A is a product of non-CM 
elliptic curves that are pairwise non-isogenous. 

Theorem 3.6. Let Ei, . . . , En be elliptic curves without complex multiplication defined over a 
number field k. Assume that the curves Ei are pairwise non-isogenous over k. Then there exists a 
positive integer B such that 

n 

Pm ■■= {llpE,,m){Gk) = {{Ai) G GL2{Z/mZr : det(Ai) = • • • = det(A)} 
1=1 

for all m relatively prime to B. 

Proof. This follows from [Rib75, Theorem 3.5] (from Faltings we know that Ribet's hypothesis is 
equivalent to the curves Ei being pairwise non-isogenous over k). □ 

Remark 3.7. 

(i) Let A be an abelian variety over a number field k. In contrast to the abelian varieties 
occurring in Theorems 3.5 and 3.6, there need not exist an integer B for which the Galois 
representations {pai'- Gk Aut(^[^])}^j5 are independent. However, there does exists 
a finite extension K/k such that the representations {pA,m'- Qk Aut(A[?7i])}m6A are 
independent for any set A of relatively prime natural numbers (see Serre's letter to Ribet 
[SerOO, p56]). 

(ii) Conjecturally many other systems of Galois representations will satisfy the conditions of 
Theorem 3.3. See [Ser94, §2] for a discussion of £-adic representations associated to motives. 
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3.4. Proof of Theorem 3.3. Fix notation as in Theorem 3.3. We first explain how to apply our 
abstract large sieve (Theorem 2.1). For each finite set Z? C A, define the Galois representation 

PD := ( n p>) : ^ n 

xeD agd 

By our ramification assumptions, we find that pD is unramified at all p G ^^(a;) — Sd where 
Sd := S U {p G Sfc : P I nAeD-^('^)} ~ UagD'^-'^' That the representations {px}x^\ are inde- 
pendent implies that Gd = IIagZ) ^® image of po and hence pD induces an isomorphism 
Gal{k{pD)/k) ^ Gd. 

Define X = Sfc(x). For each A G ^{Q), fix a function px: X ^ G\^ such that the following 
conditions hold: 

• px{p) = PA(Frobp) if p G Sfc(x) - Sx, 
•Pa(p)CCa ifpGSfc(x)n5A 

(the second condition is imposed simply to match the set-up of our abstract large sieve). It will be 
clear from context which function px we are using. 

For D C A(Q), define the function pjj := {YlxeD P>^) • ~^ ^d- define sets of 

primitive characters Prim(GD) just as in §2.1. 

For every A G A{Q), define px to be the measure on Gx as in §2.1. We have pxip) ^ Cx for all 
p G =y(x) and hence 

pxipxiyix))) < \Cx\/\Gx\. 
We may now apply our abstract large (Theorem 2.1), which gives 

(3.1) L{Q)\S'{x)\<A{X,p,Z{Q)) 

^ ^ ^ -j^ 1^ l/IG I 

where L{Q) = YloeZiQ) YixeD I CaT/IGa I " remains to bound A{X, p, Z{Q)). From Proposition 
2.3 we have 

(3.2) A(X,p,Z(Q))< ^max ^ E | E x(pd(p))x'(pd'(P))|, 

and to bound this quantity we will make use of the character sums worked out in Appendix A. 

Lemma 3.8. With assumptions as above; fix D,D' G 2{Q) and characters x £ ^^^{Gd), x' 6 
MGd'). 

(i) Let B > be a constant. If Q{x) := c(logx/(loglogx)^)^^^^'^'* for a constant c > suffi- 
ciently small, then 

E X{PD{P))X'{PD' (P)) = ^x,x' Li rr + O ( ^ ) . 

(ii) Assuming GRH, 

E X{PD{P))X'{PD'{^)) = 5x,x' Li a; + O {\Gd\\Gd' log x) . 

(iii) Assuming AHC for the extension k{p£)\jD') /k and dssuTThifig GRH, 

E X{PD{P))X'{PD'{P)) = 5x,x' Lix + 0(x(l)x'(l)xV2 logx) . 

)5GSfc(x) 
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Proof. To ease notation, define T := J2pe^^,(x)X{PD{p))x'{PD'{p)) and L := k{pouD')- We may 
view X (resp. x') as an irreducible character of GduD' by composing with the projection maps from 
Gdud' to Gd (resp. Gd')- 

The Galois representation pnuD' is unramified at all p SduD' ■= S[J{p G : p| flAeDuD' ^(-^)}- 
In particular, Pd{p) = /Oz)(Frobp) and Pd'{p) = PD'C^robp) for all p £ ^^(x) — S/juD'- Since 
Z?, D' G 2^{Q) and (5(a;) ^ -y/x, we have 



\Sdud'\<^\S\+ Y1 logiV(A)<|5|+log(n,^^A^(A)-n,g^,^W) 

AgDUD' 

< |5| +log(Q-g) <Clogx. 



Therefore, 



(3.3) T= Yl (xx')(PDuD'(Frobp)) + 0(x(l)x'(l)|SDuD'|) 



unramified in L 

Yl (x7)(PDuD'(Frobp))+0(x(l)x'(l)logx). 

peSfe{x) 

unramified in L 

Before considering the different cases, we first bound some quantities that will show up in our 
character sums. For any D E 2{Q), we have \Gd\ ^ Hasd ^i^Y < ■ Thus 

[L:k]< \Gd\\Gd,\ «Q2'-. 

Let P{L/k) be the set of primes p for which there exists a p G such that p|p and p is ramified 
in L. From our ramification assumptions, 

n p < n ^(^) « n ^(^) n ^(^) ^ 

p&P(L/k) Ae5£,uD' agd AeD' 

Therefore 

M(L/A;) := [L : A;]4/['=^^] J] 

pGP{L/fc) 

In particular, logM(L/A;) ^ logx, since we have assumed that Q{x) <^ \fx. 

(iii) Assume AHC and GRH. Applying Proposition A.4(ii) to (3.3), we have 
T = (xZ 1) Li X + o(x(l)x'(l)[fc : Ql^'^' log(M(L/A:)x)) 
= 6^,^, Lix + 0(x(l)x'(l)x'/' log: 



(ii) Assume GRH. Applying Proposition A.4(i) to (3.3), we have 

T=(xZl)Lix + 0((j] \x{g)\\x'{9)\)[k:Q]x'/Hog{AI{L/k)x: 



5^,^,Lix + 0(V |x(5)||x(5)k'/'logx). 



By the Cauchy-Schwartz inequality and the irreducibility of the characters x and x'; 

^ |X(5)I|X'(5)I < (E IX(5)P)'^'(E ,r l^'(^)l')'^' = \Gdud' 

SGG^UD' 

Therefore, 

T = 6^^^'Ux + o(\GDuD'\x^^'^^ogx^ = 6^^^'Ux + o(\GD\\GD'\x'^^'^logx]. 
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(i) By Lemma A.2, log c^l < [L : Q]logM(L/fc) < Q^HogQ, and hence 10[L : Q\{\ogdLY < 

Q^^ {\ogQ)^ . So for Q{x) := ^^ (log'io^a;)^ ) ^^^^ ^ sufficiently small constant c > 0, we will have 
logx > 10[L : Q](logdi)^ for x sufficiently large. Applying Proposition A. 8 to (3.3), we have 



T - S^y Ux « x(l)x'(l)Li(rE/^^) +x(l)x'(l)|G«,uD'l^exp(-ci[L : Ql-^/^^^^g, 



a/2 



where the Li(2;^^) term is present only when the exceptional zero Pl exists. The trivial 

bounds < IGduD'I < x(l) < \Gd\'^^ < Q^^', and x'(l) < IGd'I'/^ gr/2 g^^^ 



T - 5^,^, Ux « Li(x^^) + Q3r^g^p(^___L__(i^g^)l/2 

for some constant c' > 0. The second term is easily bounded: 



<c3'^ (log x) V2a; exp ( - / (log x) (log log x) V3 «^ 



\1+B ■ 



Finally, consider the term containing the exceptional zero. We have Li{x^^) <C x^^ so it suffices 
to show that x^^ <C x/{logx)^~^^ . By Proposition A.5(ii), there is a field F with k C. F <Z L such 
that [F :k]<2 and Cf(/3l) = 0. By Proposition A.5(iii), 

1 » min{([F : Q]! log rf-'/t^^'^l } 

> min{((2[/t : Q] - 1)! log d"^/!^^^] } » d^^/^^^^l. 

By Lemma A.2, d]^^^'-^'^ < M{F/k). Using P(F/A;) C P{L/k), 

p&P{L/k) 

and hence 1 — /3l » (logx)^-'^/^^''). Thus for x sufficiently large, (1 — /3L)logx > (1 + i?)loglogx, 
or equivalently x^^ < j;/(log x)"*^^^. □ 

We now bound A{X, p, Z{Q)). Theorem 3.3 will follow by combining these bounds with (3.1). 
(i) Fix any B > 1/3. By (3.2) and Lemma 3.8(i), 



A{X,p,Z{Q))< ^max x(.Pd{p))x'{pd'{p)) 



max 



(d^yLix + 0, 
^^y^, ^ V -^'^ V(logxa+« 

Lix + 0( ^ |Prim(Gi5) 



(log x) 1+^7' 

Now use the bound E^e^CQ) I PrimlCD)! < EiJe^CQ) l'^^' « ^ (logx)i/3: 
A(X,/),Z(g)) <Lix + 0( 



(logx)i+(S-i/3);- 
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(ii) Assume GRH. By (3.2) and Lemma 3.8(ii), 

A(X,p,Z(Q))< max ^ ^ \Y. ^(P^iPWiPD'ip)) 

D g2(0) — — I — 

x'GPrim(G^,) XGPrim(Gz,) pGX 

= max ^ ^ (^5^^^/ Lix + 0(|Gz)||Gz)/|x^/^ log: 

x'Srlm(Go') ^^^^^^ XePnm(Gz,) 

= Lix + 0f max \Gd'\- V | Prim(GD)| • x^/^ log xV 

DeZ{Q) 

and then use the inequality | Prim(GD)| < | Irr(G£))| = \g\^\. 

(iii) Assume AHC and GRH. By (3.2) and Lemma 3.8(iii), 



A{X,p,Z{Q))< ^max ^ J] | E x('°^(P))x'('°^'(P)) 

= D^zf ) Yl ('^x,x'Lix + 0(x(l)x'(l)x^/^logx; 

= Lix + of max y'(l) y(1) • x"*^/^ log x ) . 

V Z)'G2(Q) ^ / 

x'Glrr(G;,) i3G2(Q),xGlrr(G,,) 

4. The Koblitz Conjecture 

The purpose of this section is to prove Theorem 1.3. We maintain the notation introduced in 
§1.2. For each integer m > 1, let Gm be the image of pE,m- Qk GL2(Z/mZ). By Theorem 3.5, 
there exists a positive integer M such that the following conditions hold: 

• {PEM X U£\M PE/){Ok) = Gm X n£tMGL2(Z/^Z), 

• if £ divides t_E,fc! then vi{tE,k) < ve{M) where vi is the £-adic valuation. 

4.1. Sieve setup. Fix a positive function Q = Q{x) with Q{x) <^ ^/x•, we will make a specific 
choice later. We will bound the cardinality of the set 

Six) := {p G Sfc - 5s : ((t£,fcQ(x))^/2 ^ ^^2 ^ ^^^^ < \Ep{¥p)\/tE,k is prime}. 

Note that PE,k{x) = |'5(x)| + 0{Q) = |5(x)| + 0{y/x), so it suffices to bound |5(x)|. 
For each p G 5(x), the Hasse bound gives 

\E{¥p)\/tE,k > (Nip) - 2iV(p)i/2 + l)/tE,k = (iV(p)'/' - l?/tE,k > Q{x), 
so the primality of \Ep{¥p)\/tE,k implies that 
(4.1) |^p(IFp)| mod m G tE,k{'^/mZY 

for m < Q. 

Define the set A = {M} U {i : £ \ M} and let A{Q) be the set of m G A with m < Q. By our 
choice of M, the Galois representations {pE,m}meA are independent. For m G A(Q) and p G 5(x), 
either p|m or det(/ — /f_E,m(Fi'obp)) = |ii^p(Fp)| mod m and hence by (4.1) 

ps,m(FVobp) C C7„ := {AeGm-- det(/ - ^) G (Z/mZ)^}. 

With our setup matching that of Theorem 3.3, we define 

y{x) := {p G Sfc(x) - Se ■ p\m or p£;,m(Frobp) C Gm for all m G A(Q)}. 

Note that S{x) Q S^{x), so it suffices to find upper bounds for |o5^(x)|. 
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Define 

\Cm\/\Gr, 



Z{Q) = {D:DC A(Q), J] m < Q} and L{Q) = U - 



D<^Z{Q)nieD ' 

For D £ 2{Q), define Gd = YlmeD Gm- Before applying the large sieve, we will first carefully 
consider the asymptotics of L{Q) as a function of Q. 

4.2. Asymptotics of L{Q). 

Lemma 4.1. Suppose i is a prime such that Gi = GL2(Z/^Z) and i\ t^^k- Then 

l-\Gf\/\Gf\ 1^ 2£2_^_3 



\Ge\/\Ge\ £ i^-2P-P + 3i' 

Proof. In this case, \Ge\ is the number of matrices A S GL2(F^) that do not have 1 as an eigenvalue; 
this can be counted directly, for example by using [Lan02, XVIII Table 12.4]. We find that jC^I = 
^4 _ 2£3 _ £2 _^ 3^ j^^j I GL2(F£)| = £{i - 1)2 + 1). The lemma is now a direct computation. □ 

We introduce the Dirichlet series 

mgA ^ ' n=l 

the significance is that L{Q) = X^„<q For each prime i, define 

Q = {2f -£- 3)/{i^ - 2£^ -£^ + ?,£). 
Instead of it will be more convenient to work with the Dirichlet series 



(4.2) n (1 + w + c,r-) - ■ 

i ^+ \Cm\/\Gm\ 

where the expression in terms of h{s) follows from Lemma 4.1. The Dirichlet series g{s) converges 
to a non-vanishing holomorphic function on the domain Re(s) > 0. 

Lemma 4.2. The function g{s) has an analytic continuation to a nonvanishing function on a 
neighbourhood of Re(s) > except for a simple pole at s = 0. The residue of g{s) at s = is 

n,((i + (i+^^))(i-i))- 

Proof For Re(s) > 0, 



cd-' -ce£~^'~-£-^'~^). 



bmce cg = 2/f + 0{l/i^), this Euler product converges absolutely and is nonvanishing in a neigh- 
bourhood of Re(s) > 0. The first statement of the lemma is now immediate. The second statement 
follows by setting s = in the product and noting that C{s + 1) has a simple pole at s = with 
residue 1. □ 

By Lemma 4.2 and (4.2), we find that h{s) analytically continues to a neighbourhood of Re(s) > 
0, except for a simple pole at s = 0. The residue of h{s) at s = is 

1- |Ca/|/|Ga/|\ 



1 + 



n04)n((-^)('-^ 



\cm\/\gm\ y^i^^ . ^^^^ 

\Gm\/\Gm\ -q \Gi\/\Ge\ I ^. ^^^^^-1 
Ue\M (1 - 7) ~ i) / 
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Remark 4.3. The number CE,k just introduced is exactly the constant from Conjecture 1.1 that is 
predicted in [ZywOSa]. Using our assumptions on the integer M, it is easy to check that CE,k is 
independent of the initial choice of M. 

Applying the Wiener-Ikehara theorem [Lan94, XV Theorem 1] to the Dirichlet series h{s — 1), 
which has a simple pole at s = 1, we find that ^n<Q ~ ^e\Q + ^(Q)- partial summation 
([MurOl, Theorem 2.1.1]), 

(4.3) L{Q) = Y,bn = log Q + o{\og Q) . 

n<Q 

4.3. Proof of Theorem 1.3. We finally apply the large sieve. First consider the unconditional 

case. For all m G A, \Gm\ < |GL2(Z/mZ)| < ?n^; so set r = 4. By Theorem 3.3(i), with 
Q{x) := c (logx/(logloga;)^)^''^^ we have 

\^{x)\ < (x/logx + o(2;/logx))/L((5). 

From (4.3), 

L{Q) = log Q + o(log Q) = (24Cs,fc)^i log log x + o(log log x). 

Therefore, 

\y{x)\ < (24 + o(l))Cz,,fc- -. 

(log x) (log log x) 

Now assume GRH. For D G Z{Q), we have \Gd\ < UmeD ^'^ < Q^- % Lemma B.3, | GL2(Z/«)»| = 

\gU\Gd\«Y.Q'^Q' 

DeZ{Q) d<Q 

By Theorem 3.3(ii) and (4.3), 

\y{x)\ < {Ux + 0{Q^^x^/Hogx))/L{Q) < {CE,k + o{l)){Ux + 0{Q^^x^/Hogx))/logQ. 
For a fixed constant 6 > 0, define Q{x) := x^^'^'^ / {log x)^"^^^^^^^ . Therefore 

\yix)\ < iUx + Oix/ilogx)'+'))/i{22CE,k)-'logx + oi\ogx)) < (22 + o(l))C£;,fc- 



(log x)2 

5. Elliptic curves and thin sets 
The goal of this section is to prove Theorem 1.6. 
5.1. Reduction of thin sets. 

Definition 5.1. Let be a subset of Z". For each prime i, let C (Z/^Z)" be the reduction of 
Cl modulo £. 

Lemma 5.2. Let Q C Z"^ be a thin set. 

(i) There are thin sets Qi, . . . , ^Im ^ Z", a set of primes A C Sq with positive natural density, 
and a real number < c < 1 such that Q = IJi^i ^'^^ < ci"' for all 1 < i < m and 
iGA. 

(ii) Suppose ^ is a thin set of Type 1. Then <^ i"^'^ for all i G T,q, where the implied 
constant depends on Q and n. 

Proof. Part (i) is a consequence of [Ser97, §13 Theorem 5]. Part (ii) follows from the Lang- Weil 
bounds [LW54]. □ 

22 



5.2. Proof of Theorem 1.6. We are interested in bounding the cardinality of the set S{x) := 
{p G : {ap{Ei), . . . , ap{En), N{p)) £ fi}. By Lemma 5.2, we need only consider the case 

where there is a set A C of positive density and a number < c < 1 such that jf^^l < cf""*"^ for 
ah iGA. 

Let G/ SpecZ be the algebraic subgroup of (GL2)'^ such that 

G{R) = {{Ai, ...,An)e GL2{Rr : det(^i) = • • • = det(A„)} 
for each commutative ring R. For every integer m > 1, we have a Galois representation 



Pm := llpE,,m: Gk ^ GL2(Z/mZ)". 



i=l 

By Theorem 3.6, there is an integer B such that pm{Qk) = G{'L/rnL) for all m relatively prime 
to B. We may assume that d \ B for all ^ S A and hence the Galois representations {p^j^gA are 
independent. Let 5 be a finite subset of S^. such that the elliptic curves Ei, . . . , En have good 
reduction outside S. 

For each prime £ G A, define the set 

Ci = {{Ai) e G(Z/«) : (tr(Ai), . . . , tr(^„), det(yli)) G Qi}. 

For 8l\ £ £ A and p G S{x), either p £ Si := S U {p : p\£} or ^^(Frobp) C Ce. 

Fix a positive function Q = Q{x) with Q{x) <C y/x, we will make a specific choice later. With 
our setup matching that of Theorem 3.3, we define 

y{x) = {p G Sfc(x) : peSe or p^(Frobp) C Ce for all £ G A(Q)}. 

Note that S{x) C so it suffices to bound \y{x)\. 

Before applying the large sieve, we first calculate some related quantities. The calculations reduce 
to counting various elements of GL2(Z/£Z), see Lemma B.3. For any £ G A{Q): 

|G(Z/«)| = - 1)1 SL2(Z/«)|" = r(£ - l)"+^(£ + 1)" 

n 

l*^^! = Yl n ^ GL2(Z/«) : tr(A) = U, det{A) = d}\ 

{ti,...,t„,d)efle i=l 

< Yl {£{£ + l)T = \^e\{£{£ + l)T < c£'^''^\£ + l)"" 

{tl,...,tn,d)(^fll 

\Ce\/\G{Z/£Z)\ < c(l + {£- l)-i)"+^ 

After possibly removing finitely many primes from A, there is a constant c' < 1 such that |C^|/|G(Z/£Z)| < 
c' for all £e A. By Lemma B.l(iii), |G(Z/£Z)f | < {£ - 1)| SL2(Z/«)f|", and by Lemma B.2 there 
is an absolute constant k > 1 such that |G(Z/£Z)''| < < 

Define Z{Q) = {D : D C A{Q), UieD < Q) and = EoeZiQ) Ueeoi^ " c')/c'- Since A 

has positive density, we have 

L(Q)> E 



logQ 

eeA,e<Q/K 
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For D e Z{Q), define Gd = UeeD ' 



\gd\ = n iG(z/«)i < (n^)'"''' ^ < Q=^"+^ 

\gUgd\<\z{qW-''<q'''^' 

DeZ{Q) 

Applying Theorem 3.3(i) with r = 3n + 1, 

(logx)V(6r-) 



(loglogx)l+V(3r) 

and hence 

in.)\ « (x/logx)/L(Q) « "^1;^^^^^^^^^^^^ 
Assuming GRH, by Theorem 3.3(ii) 

\S^ix)\ < (x/logx + Q^"+V/2logx)/(Q/logQ); 
choosing Q{x) = {x^^"^ /{logx)'^y/^'^^'^^^ gives 

|^(X)| « xl-l/(14n+8)(log^)2/(7n,+4)^ 

5.2.1. T/iin seis o/ Type 1. Now assume that il. is thin of type 1; i.e., is not Zariski dense in 
Aq"*"^. By Lemma 5.2, there is a constant C > such that jO^I < C^" for all primes i. For each ^, 
define Ci = {{Ai) G G(Z/£Z) : (tr(Ai), . . . , tr(^„), det(Ai)) G O^. Arguing as before, we find the 
following bounds. 

n 

1*^^! = Yl Yl\{AeGL2{Z/a) -.tiiA) = ti,det{A) = d}\ 

{ti,...,tn,d)<^^e «=1 

(ti ,...,t„,d)en^ 

By possibly increasing the value of G, we always have \Ge\/\G{7j/i7j)\ < G/l. Take any prime i\ B, 
where B is the constant from Theorem 3.6. Let Li be the fixed field of ker(p£) in k; there is an 
isomorphism 

Pe: Gal{Li/k) ^ G(Z/«), 
which we will use as an identification. For all p G — S with p \ i, pi(Frohp) C Gg. Therefore, 

|{p G Sfc(x) : (ap(^i),...,ap(^„),iV(p)) G n}\ < 7rc,{x, Le/k) + 0{1); 

see §A.l for notation. It thus suffices to bound 7rQ(x, Li/k), and this can be done using the effective 
versions of the Chebotarev density theorem given in Appendix A. We first calculate M{Li/k) (see 
Definition A.l). 

p£P{L/k) pes 
Assuming GRH (and assuming, say, £ < x), by Proposition A.3(i), 
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Choose i \ B such that 

(this can be done assuming x is sufficiently large). With this choice of i, 

2,l-l/(6n+2) 

7rci{x,Li/k) < 



(loga;)i"2/(3n+i) ' 

Now consider the unconditional case. By Proposition A. 7, 

1 X 

TTCi{x,Li/k) <C 



log X ' 
assuming that 

(5.1) logx > C2(log(iLj(loglogdL,)(logloglog6di,J, 

where C2 is some absolute constant. By Lemma A. 2 and the above bound for M{Li/k), 

log dL, < [Li : Q] log M(L,/fc) « log^, 

and hence 

(5.2) (log dL J (log log (ii J (log log log edL J < f'^+^log If {\og\og I). 

Let c > be a constant which will be chosen sufficiently small, and suppose we have l \ B with 

/ logx V^''^"^^'' < ^ < 2 ( logx \i/{3n+i) 

V(loglogx)2(loglogloga;)/ ~ ~ V (log log a;)^ (log log log x)/ 

For c > sufficiently small, the bound (5.2) shows that (5.1) will hold. With such an 

I rj. 2;(logloga;)^/(^"+^)(loglogloga;)^/(^"+^) 
£logx (logx)i+^/^'^"+^^ 
Such a prime i will exist assuming x is sufficiently large. 

Remark 5.3. If we assume GRH and AHC, then for I < x, Proposition A.3(ii) gives 

7Tc,{x,Le/k) « +£3n/2^1/2i 
£ log X 

Choosing £ « (xV2/(log x)2)2/(3"+2) 

gives the bound 

^l-l/(3n+2) 

|{p G Sfc(x) : (ap(Si), . . . , ap{En), N{p)) G n}\ « 



(logx)i-4/(3'^+2)' 

6. Explicit Chavdarov 
The purpose of this section is to prove Theorem 1.13. We keep the notation introduced in §1.4. 

6.1. Group theory of S„. For a positive integer n, let (3„ be the symmetric group on {1, 2, . . . , n}. 
A partition of n is a sequence a = (di , . . . , cjfc) of integers such that n = ctj and cri > • • • > ak > 
1. The cycle type of a permutation r G is the partition a = (cti, . . . , cj^) of n for which r can 
be written as a product of disjoint cycles of lengths ai, . . . ,ak- 

Let f(T) G Z[T] be a separable polynomial of degree n with roots ai , . . . , a„, in Q. The numbering 
of the roots induces an injective homomorphism Gal(/(T)) ^ 6„. This homomorphism, up to an 
inner automorphism of S„, is independent of the choice of numbering. 
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Definition 6.1. Let f{T) E Z[T] be a polynomial of degree n and let a = (cii, . . . , ak) be a partition 

of n. We say that cr is a cycle type of / if / is separable and the image of Gal(/(T)) ^ ©„ contains 
a permutation with cycle type a. An equivalent condition (by the Chebotarev density theorem) is 
that there exists a prime i such that /(T) mod £ E F£[T] factors into distinct irreducibles of degrees 
(Ji, . . . ,crfc. 

Lemma 6.2. Lei f(T) E Z[T] 6e a polynomial of degree n. Suppose that a is a cycle type of f{T) 
for each partition a of n. Then Gal(/(T)) = ©„. 

Proof. The cycle type of a permutation in S„ induces a bijection between partitions of n and 
conjugacy classes of 6n- Our assumption implies that the image of Gal(/(r)) ^ &n meets every 
conjugacy class of S„. A classical lemma of Jordan, says that for each proper subgroup H of a finite 
group G, there is a conjugacy class C E Gtt such that i7 n C = 0. Therefore, Gal(/(r)) ^ ©„. □ 

6.2. Group theory of W2g- Fix an integer g > 1. Recall that W2g is the subgroup of &2g which 
induces an permutation on the set of pairs {{1, 2}, {3, 4}, . . . , {2g — 1, 2g}^. The action of W2g on 
these g pairs gives an exact sequence 

(6.1) l^H^W2g^6g^l. 

The group H is generated by the transpositions (1,2),..., {2g — 1, 2g), and hence is isomorphic to 
{Z/2Zy. In particular, \W2g\=2Sg\. 

Lemma 6.3. Let G be a subgroup ofW2g- If G contains a transposition and (j){G) = &g, then 

G = W2g. 

Proof. From the assumption (j){G) = &g and (6.1), it suffices to show that H Q G. In particular, 
it suffices to show that G contains every transposition of the form {2i — 1, 2i). 

By assumption, G contains a transposition. This transposition must be an element of H, and we 
may assume that it is (1, 2). Since (i){G) = &g, there exists a r E G which switches the pairs {1, 2} 
and {2i— 1, 2i}, and leaves the other pairs fixed. The permutation r(l, 2)r~^ is thus (2i — 1, 2i). □ 

6.3. Abelian varieties over finite fields. 

Definition 6.4. Let A be an abelian variety of dimension g > 1 over a finite field Fg. Let 
Qa{T) E Z[T] be the unique polynomial such that Pa(T) = T9Qa{T + q/T). (The existence of 
Qa{T) is a direct consequence of the functional equation PA{q/T)/{q/T)^ = Pa{T)/T^). 

Lemma 6.5. Let A be an abelian variety of dimension g over ¥q. Suppose that Pa{T) has cy- 
cle types {2g) and (2, 1, 1, . . . , 1), and Qa{T) has cycle type a for each partition a of g. Then 
Gal{PA{T)) ^ W2g. 

Proof. The polynomial PAiT) is irreducible since it has cycle type {2g). Let tti, . . . , 7r2g be the roots 
of Pa{T) in Q, they are non-rational and distinct since Pa{T) is irreducible. We may assume that 
the TTj are numbered such that the product of any of the pairs {vri, 7r2}, . . . , {■K2g-i-, '^2g} is q (since 
Pa{T) is irreducible of degree 2^, =by^ can be roots only when (7 = 1, in which case the lemma is 
trivial). The numbering of the tTj induces an injective homomorphism Gal(PA(T)) ^ ^2g] let G 
be the image of this map. Since Pa{T) has cycle type (2, 1, 1, ... , 1), the group G C ©2g contains 
a transposition. 

The polynomial Qa{T) is monic of degree g. Since the value of T + q/T at any element of a 
pair {vr2j_i, '7r2j} is the same, we find that roots of Qa{T) correspond with our g pairs of roots of 
Pa{T). By Lemma 6.2, Gal(Q^(r)) ^ &g. Thus (/>(G) = 6^, where (f) is the map from (6.1). By 
Lemma 6.3, Gal(PA(T)) ^G = W2g as desired. □ 
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Definition 6.6. Let P{T) E Q[T'] be a monic polynomial of degree n, and let ai, . . . ,q;,„ E Q be 
the roots of P(T). For each integer m > 0, define P^'^^(T) := Hil^ ~ '^T) which is a well-defined 
element of Q[r]. 

Let A be an abelian variety over the finite field ¥q with q elements. Then for all m > 1, (T) = 

PAx¥qm{T). The next lemma gives a useful criterion to test whether Gal(P^™^(T)) = Gal(Pyi(T)) 
for all m > 1. 

Lemma 6.7. Let P{T) E Q[r] he an irreducible polynomial of degree n with Galois group G. 
There is an integer s = s{n) > 0, depending only on the degree of P(T), such that if the polynomial 
p('^)(^T) is separable, then the polynomial p("*)(T) E Q[T] is irreducible and has Galois group G for 
all integers m > 1. 

Proof. This follows from [Cha97, Lemma 5.3]. □ 

6.4. Proof of Theorem 1.13. Fix a positive function Q = Q{x) with Q <^ y/x which will be 
specifically chosen later. Define the set A = {i : i\ B}, where B is the constant from Theorem 3.5. 
Thus the representations {pA,i}eeA are independent. Let A{Q) be the set of elements in A which 
are at most Q. 

• Let be the set of p E Sfc(ic) — Sa such that Pa^ (T) does not have cycle type {2g). 

• Let S2{x) be the set of p E Sfc(x) — Sa such that PAp{T) does not have cycle type 
(2,1,1...,1). 

(s) 

• Let Sslx) be the set of p E Sfc(x) — Sa such that P\^{T) is not separable, where s = s{2g) 
is the integer from Lemma 6.7. 

• For each partition a of g, let Sa{x) be the set of p E Sfc(x) — Sa such that Qa^ (T) does not 
have cycle type a. 

Lemma 6.8. There is an inclusion n^(x) C Si{x) U S2{x) U 53(x) U {J^Sa{x), and hence 

\IIa{x)\ < \Si{x)\ + \S2{x)\ + |cS3(x)| + \SAx)\- 

Proof Take any p E S^. (x) - 5"^ with p 5i (x) U ^2 (x) U ^3 (x) U 5,^ (2;) • Since p 5i (x) U ^2 (x) , 
PAp (T) has cycle types {2g) and (2, 1,1,..., 1). For each partition a oi g, p ^ 5o-(x) imples that 
QApiT) has cycle type a. By Lemma 6.5, Gal{PAp(T)) = W2g- Since p Ssix), we find by 
Lemma 6.7 that 

Gal{Pi^\T)) ^ GaliPApiT)) ^ W2g 
for all m > 1. Therefore, p ^ IIa{x). □ 

For each prime i, define the following sets: 

• Let C} be the set of B E GSp2g{^i) such that det(r/ - B) £ ¥i[T] is reducible. 

• Let C| be the set B E GSp2g(F£) such that det(r/ - B) £ F^T] is not the product of an 
irreducible quadratic and 2g — 2 distinct linear terms. 

• Let s = s{2g) be the integer of Lemma 6.7. Let Cf be the set of S E GSp2g(F£) such that 

E F^T] is not separable, where P{T) = det(T/ - B). 

• For each partition a = (cji, . . . , Uk) of g, let G^ be the set of S E GSp2g(F^) such that Q{T) 
does not factor into distinct irreducible polynomials of degree o"i,...,(Tfc, where Q{T) E 
¥i[T] is the unique polynomial such that det(r/ - B) = T3Q{T + in{B)/T). 
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Lemma 6.9. There are constants B' > and < S < 1, depending only on g, such that for all 
primes I > B' , 

(6.2) max — — — ^ < 5 and max , ^ < 5. 

i=l,2,3 I GSp2g(F£)| a partition of g \ GSp2g(F^)| 

Proof. These bomids follow from the computations done in [Cha97] (in particular, see Corollary 
3.6, Lemma 5.7, Lemma 5.4, and Lemma 5.9). Chavdarov's bounds are done for the S^2g^t) cosets 
of GSp2g(F^), our lemma follows by combining these bounds. Also note that the formulation of 
some of these results looks slightly different in [Cha97] because the characteristic polynomials there 
are the reverse of ours. □ 

We have reduced to the case of bounding the following cardinalities separately: |5i(x)|, |52(x)|, \S^{x) 
and |5o-(x)| for each partition a of g. For purely notational reasons we only bound |5i(x)|; 
the arguments in the other cases are identical. For any I G A((5) and p G 5i(x), either )p\^ or 
/9A/(Frobp) C C}. So Si{x) C ^^(x), where 

^i(x) := {p G Sfc(x) - Sa ■■ P\i or pA/(FVobp) C Ce for all i € A{Q)}. 

We will now use the large sieve as in Theorem 3.3 to bound \S^i{x)\. 

By possibly increasing B, we may assume that (6.2) holds for all l\ B. By Lemma B.2, there is 
a constant k > 1 such that | GSp2g(F^)f | < (k;£)s+i. Define 

Z{Q) = {D:D<ZK{Q),W^^^Ki<Q] and L{Q) = J] 11 
where 5 is the constant from Lemma 6.9. Note that 

For D G Z{Q), define Gd = H^eD GSp2g(F£). We shall use Lemma B.2 in the following bounds. 

\Gd\ = n I GSp2,(F,)| < (n ^)''^^'^' < (Q/kI^I)2^^+^+i < Q^^^+^+i 



\gu = n I Gsp2g(F,)»i < (n ^^y^' < q'^' 

Applying Theorem 3.3(i) with r = 2(jr^ + g + 1 gives 

L(Q) » Q/ log Q » ^^^^""^'ZL) 
(log loga;)^+^/^'^'^-' 

and hence 

\S,{x)\ < |^,(x)| « (x/logx)/L(Q) « \^^Jy:y^,,^._,,,^,^ . 
Assuming GRH, by Theorem 3.3(ii) 

\^l{x)\ < (x/logX + Q^3^+35+V/2^Qg^)/^g/jQgg^. 

choosing Q{x) = {x^/^ /{logx)'^)^^^^^'^^^3+4^) gives 

\Si{x)\ < |^i(x)| «xi-i/(83^+63+s)(logx)2/(V+3<;+4), 
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Identical bounds will hold for all the |52(2;)|, |53(x)| and So by Lemma 6.8, we have 

'x(loglogx)^+l/(69^+39+3)/(log^)l+l/(1292+69+6) 

, ^1-1/(89^+69+8) (log ^)2/(452+39+4) assuming GRH. 

7. The Lang-Trotter Conjecture 



|nA(x)| < 



The purpose of this section is to give an application of our large sieve to a problem for which 
there is a priori results that can be used as a benchmark to measure how effective our sieve is. 

Fix an E be an elliptic curve without complex multiplication that is defined over Q. For an 
integer t, define 

UeAx) := \{p < X : apiE) = t}\. 
With notation as above, we have the following well-known conjecture of Lang and Trotter [LT76]. 

Conjecture 7.1 (Lang- Trotter). There is an explicit constant C^;^^ > such that as 2; ^ 00, 



n£;,f(x) ~ Ce,, 



log X 

If CE,t = 0, then this defined to mean that there are only finitely many primes p with ap{E) = t. 

Theorem 1.6 (with n = 1, Q, = {t} x Z) gives immediate upper bounds on IlE^tix). If we assume 
both GRH and AHC, then Remark 5.3 (which does not use the large sieve) gives the bound 

(7.1) ^£;,^(rE)«x4/V(logx)^/^ 

Murty, Murty, and Saradha [MMS88] have proven (7.1) assuming GRH (but not AHC!). 

Theorem 7.2. [MMS88] Let E be a non-CM elliptic curve over Q and let t be an integer. Assuming 
GRH, we have UE,t{oo) < x^^/^ilogx)^/^. 

Their proof reduces the bound to an application of an effective version of the Chebotarev density 
theorem to abelian extensions (where AHC is known to hold!). The result in [MMS88] is actually 
stated for modular forms but the elliptic curve proof is identical. 

The goal of §7 is simply to prove, assuming GRH and AHC, the bound (7.1) by using the large 
sieve of Theorem 3.3. 

Before continuing, it is necessary to explain what this is meant to demonstrate. Recall that the 
large sieve inequality used in Theorem 3.3 comes from the easy bound of Proposition 2.3 and many 
character sum estimates from Appendix A. That we can recover known bounds, shows that these 
estimates for the large sieve inequality are not so bad. 

One would hope that "on average" the error terms in these character sum estimates are small, 
and thus a stronger large sieve inequality should be true^. This example shows that any interesting 
improvement in the large sieve inequality, over the somewhat naive approach used in this paper, 
would have important arithmetic consequences. 

For simplicity, we will assume that t 7^ 0. One can prove stronger bounds in the t = case 
by using the corresponding Galois representations Qq PGL2(Z/£Z). In fact, Elkies [Elk91] has 
shown unconditionally that IIe,o{x) ^'^^^ ■ For t 7^ 0, it is still unknown (unconditionally) 
whether IlE,t{x) <C x^~^ for some 6 > 0. 



This leads to other natural questions; for example, what is the elliptic curve analogue of the Bombieri- Vinogradov 
theorem? 
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7.1. Sieve setup. By Theorem 3.5 (with g = 1), there is a positive integer B such that 

PE,m{GQ) = GL2(Z/mZ) 

for all integers m relatively prime to B. We may assume that B is divisible by the prime factors of 
2t. Fix a positive function Q = Q{x), to be chosen later, such that Q{x) <C y/x. Define the sets 

A{Q) = {i:£<Q,e\B} and S (x) = {p e ^q{x) : ap{E) = t} . 

For each £ G A((5) and p £ S{x), either p £ Se'J {£} or 

PE,e{Fiohp) C Ce := {A e GL2(Z/£Z) : tr(^) = t mod £}. 

With our setup matching that of Theorem 3.3, we define 

y{x) := {p e :pe SeU{£} or pE,i{FTohp) C d for all £ G A(Q)}. 

Note that S{x) C ^(x), so it suffices to find upper bounds for 
Define the set Z{Q) = {D : D <Z A(Q), Ueeol^ + 1) < Q}, and 

T(n)= V rj ^-\Ci\/\GL2{z/£Z)\ 

^^J ii \Q\/\GL2{Z/£Z)\ • 

For D G we define Gd = nteDGL2(Z/«). Fix an element £ G A(Q). Using the Cauchy- 

Schwarz inequality and Lemma B.3, we have 



XeIrr(GL(Z/«)) xeIrr(GL(: 

= I GL(Z/«)|^/2| GL(Z/^Z)#|^^^ < = £^. 

Therefore, 

E E x(i)< E n( E x(i))< E {Il^y<\^mQ'<Q'- 

D&Z{Q)x&rr{GD) D(^Z{Q)l(iD xGlrr(GL2{Z/ffl)) D£Z{Q) l&D 

For each £\ B, from the description of the characters of GL2(Z/^Z) in [Lan02, XVIII, §12], 

max x(l) = £ + 1, 

XeIrr(GL2r 



and thus 

max y(1) = max TT + 1) < Q. 
By Theorem 3.3, assuming AHC and GRH, we have 

(7.2) HeM = \S{x)\ < \y{x)\ <{Ux + 0{Q^x^/^ \ogx))L{Q)-\ 

7.2. Asymptotics of L{Q). In this section, we will prove an asymptotic lower bound for L{Q). 
By Lemma B.3, for any £ G A{Q) 

\CA £"^-£-1 



\Cf\=£{£^ -£-l) and 



GL2(Z/«)| (^-1)2(^ + 1)' 



so 



D£Z{Q)ieD Dez(Q)eeD 
Let fi be the Mobius function, and define the arithmetic functions 

(p{n) =nYl{l-l/£) and ij{n) = nflil + l/£). 

l\n l\n 
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Thus 

(7.3) L(Q)= Yl 11(^-1)^ E f^\dMd)» J2 ^'(dMd)- 

D€Z{Q)e£D ■<P{d)<Q ii{d)<Q 

To find a lower bound for this expression, we wih apply the following result on the distribution of 
the values Lp{n)/n. 

Lemma 7.3 ([Kac59, Chapter 4, §2]). Define a function F : M ^ [0, 1] hy 

F(z) ■= hm < ^ : "Pj^)/^ < 41 

The map F is well-defined (i.e., the limits exist) and is continuous. 
Lemma 7.4. J2i,id)<Q f^'HdMd) > Q^- 
Proof. For any positive integer d, 

d^ > m^id) = d' - ^) ^ = ^d^ 

l\d 

and so 

(7.4) ^^'(dMd) > A J2 Ad)^^ > E /^^(^)^^- 
Fix a constant c with < c < 1, we then have the following easy inequalities 

il>{d)<Q cQ/2<d<cQ cQ/2<d<cQ 

ip{d)/d<c-^ il){d)/d<c-^ 

Since Lp{d)/d > c implies ip{d)/d < c~^, we have 

(7.5) Y f^\dMd)>^Q fi\d):^c^Q\AQnBQ\, 

ip{d)<Q cQ/2<d<cQ,c<ip{d)/d 

where 

Aq = {d G [cQ/2, cQ] : d squarefree} and Bq = {d £ [cQ/2, cQ] : c < '^{d)/d} . 
By Lemma 7.3 

\Bq\ = {1-F{c))cQ/2 + o{Q), 
and it is well known that \Aq\ = (6/7r^)c(5/2 + o{Q). 

\Aq n Bq\ = \Aq\ + \Bq\ - \Aq u Bq\ 

> \Aq\ + \Bq\-{cQ/2 + 1) 

= + (1 - i^(c))f - f + o(Q) = - F(c)) ^ + oiQ) 

Now choose our constant c such that -F(c) < G/vr^ (this can be done since F is continuous, and 
F(0) = 0, F(l) = 1). Equation (7.5) becomes E^,{d)<Q fJ-^idMd) > Q^- □ 

Combining (7.3) and Lemma 7.4 proves the following: 

(7.6) LiQ) » Q\ 

31 



7.3. Final bound. Using (7.2) and (7.6), we have 

^eA^) {x/\ogx + Q^x'^/'^\ogx)Q-'^. 
Setting Q{x) = x'^^'^^ /{logxf/^ , we deduce that 

n£,t(x) <x^/V(loga;)i/5 

assuming GRH and AHC. 

Appendix A. Character sums and the Chebotarev density theorem 

A.l. Notation. Let L/k he a Galois extension of number fields with Galois group G and let C be 
a subset of G stable under conjugation. Define 

7rc{x, L/k) := \{p G Sjt(a;) : p unramified in L, Frobp C C}\. 

The Chebotarev density theorem says that 

TTc{x,L/k) ~ — Lix 

as a; ^ oo. An effective version would give an explicit bound for TTc{x,L/k) — |C|/|G| Li a:. 

The extension L/k is said to satisfy Artin's Holomorphy Conjecture (AHC) if for each x £ 
Irr(G) — {1}, the Artin L-series L(s,x) has analytic continuation to the whole complex plane. 

The Generalized Riemann Hypothesis (GRH) asserts that for any number field L, the Dedekind 
zeta function Cl{s) has no zeros with real part > 1/2. 

Definition A.l. Let L/k be an extension of number fields. Define 

M(L/A:) = [L : ^l^/I^^^l J] P 

p&P{L/k) 

where d^ is the absolute discriminant of k and P{L/k) is the set of rational primes p for which 
there exist a prime p G such that p|p and p is ramified in L. 

Lemma A. 2. Let L/k he a Galois extension of number fields. Then logd^ < [L : Q] log Af (L/Zc). 
Proof. This follows by combining equations (3) and (6) of [SerSl]. □ 
A. 2. Conditional versions. 

Proposition A. 3. Let L/k be a Galois extension of number fields with Galois group G and let C 
be a subset of G stable under conjugation. 

(i) Assume GRH. Then 

7rc{x,L/k) = \^^Ux + 0[\C\x^/^[k : Q] log {M{L/k)x 

(ii) Assume GRH and assume AHC for the extension L/k. Then 

Tic{x,L/k) = 1^ Ux + o{\C\^l^x^l^[k : Q] log {M{L/k), 
In both cases, the implicit constants are absolute. 

Proof. Part (i) is equation (20ij) of [SerSl] . Part (ii) is a consequence of [MMS88, Proposition 
3.12]. □ 

Proposition A. 4. Let L/k be a Galois extension of number fields with Galois group G and let x 
be a character of G. 

32 



(i) Assume GRH. Then 

x(Frobp) = {xA)Ux + 0{{^^Jx{9)\) [k : Q]xV2log [M{L/k)x)). 

p unramified in L 

(ii) Assume GRH and assume AHC for the extension L/k. Then 

J2 x(Frobp) = (x, 1) Lix + o(x(l)[A: : Q]x'/^ log (M(L/A;)x)) . 

p unramified in L 

In both cases, the implicit constants are absolute. 

Proof. Part (i) follows from equation (33r) of [SerSl] and Lemma A. 2. We now consider part 
(ii). By additivity it suffices to prove the proposition for an irreducible x- Let be the Artin 

conductor of x and define A^^ = d^^'^^ N^iq{^^). See [MMS88, Proposition 3.5] for a sketch that 
x(Frobp) = {x,l)Ux + (x^'^{\og A^ + x(l) [k : Q] log x 

peSfc{a;) 
p unramified in L 

+ 0(xm : Q] log([L : k]d]!^'--'^^J[^^^^^^^^p] 

By Proposition 2.5 of [MMS88], \og{Nk/Q{^^)) < 2x{l)[k : Q]log([L : k]Y\pePiL/k)P) and hence 

log^;, < 2x{l)[k : Q]log([L : A:] JJ^^^^^^^^p) + x(l) log 4 

<2x(l)[A::Q]log([L:Ai4/[^^«]n,,p(,./,/ 
Combining everything we obtain 

J2 x(Frobp) = (x,l)Lix + 0(xi/2x(l)[A: : Q]log([L : fc]4^"'^'^npeP{L/fc)^)) ' ° 

peEfe(a;) 
p unramified in L 

A. 3. Exceptional zeros. 
Proposition A. 5. 

(i) Let L ^ Q be a number field. Then Cl{s) has at most one real zero in the interval 1 — 
(41ogdi)~^ < a < 1. Such a zero of C,l{s), if it exists, is simple. 

(ii) Let L/k be a Galois extension of number fields and suppose that [3 > 1/2 is a real simple 
zero of Cl{s). Then there is a field F with k <^ F C L such that [F : k] < 2 and Cf(/3) = 0. 

(iii) Let F Q be a number field and suppose (3 is a real zero of C,p{s). Then 

1 - /3 » min{([F : Q]!logdp)-i,d-^/[^^'^l}, 
where the implicit constant is absolute. 

Proof. For part (i), see [Sta74, Lemma 3]. Part (ii) is due to Heilbronn, see [Sta74, Theorem 3] 
for a generalized version. The estimate in part (iii) can be found in the proof of [Sta74, Theorem 
1']. □ 

Definition A. 6. Let L 7^ Q be a number field. If the simple real zero of C,l{s) described in 
Proposition A.5(i) exists, then we call it the exceptional zero of L and denote it by [3l. Note that 
(s) has no real zeros in the interval < a < 1. 

33 



A. 4. Unconditional versions. 

Proposition A. 7. Let L/k be a Galois extension of number fields with Galois group G. Let C be 
a subset of G that is stable under conjugacy and let C be the set of conjugacy classes of G which 
are subsets of G . 

(i) There is an absolute constant ci > such that if logx > 10[L : Q](log(ii)^, then 



7Tc{x,L/k) - i^Lia; < 1^ Li(x^^) + 0(^|C|xexp(-ci[L : Q]-^/^(logx 

where the ^hi{x^^) term is present only when the exceptional zero Pl exists. 
(ii) There is an absolute constant C2 > such that i/logx > C2(log(iL)(loglog(ii)(logloglog6dL), 
then 

Trc{x,L/k) < 



|G| logx' 

Proof. Part (i) is a consequence of [L077, Theorem 1.3]. Part (ii) is stated as in [SerSl, Theoreme 3] 
and is a result of Lagarias, Montgomery, and Odlyzko. □ 

Proposition A. 8. Let L/k be a Galois extension of number fields with Galois group G and let x 
be a character of G. If logx > 10[L : Q]{logdL)'^ , then 

J2 x(Frobp) = (x,l)Lix + 0(x(l)Li(x^^)) 
peSfe(x) 

p unramified in L 

+ 0fx(l)|G»|xexp(-ci[L : Q]-i/2(iog 3,)i/2; 



where the x(l)Li(2;^^) term is present only when the exceptional zero (3l exists, and the constant 
ci > and the implicit constants are absolute. 

Proof. It suffices to prove the proposition for an irreducible character x- We first write the character 
sum in terms of the vrc(x, L/k), 

^ x(Frobp) = x{C)7Tcix,L/k). 

p unramificd in L 

Using X](7gG'tt x(C')|C'l/|G'| = (X)l) ai^d maxQ^Qt |x(C)| = the proposition follows directly 

from Proposition A.7(i). □ 

Appendix B. Group theory for GSP2g 

B.l. Symplectic groups. Fix a field k, a finite dimensional vector space V of dimension 2g over 
k, and a nondegenerate alternating bilinear form { , ) : V x V ^ k. We define GSp(y, ( , )) to be 
the group of ^ G Aut(l^) such that for some m(yl) £ k^ , we have {Av,Aw) = m{A){v,w) for all 
v,w gV. Define Sp(y, ( , )) to be the group of automorphisms of V which preserve the pairing. We 
call GSp(y, (, )) (resp. Sp{V, {, ))) the group of symplectic similitudes (resp. the .symplectic group). 
The element m{A) £ k^ is called the multiplier of A, and gives an exact sequence 

i^Sp(y,(,))^GSp(y,(,))^fc>^^i. 

Up to isomorphism, V has a unique non-degenerate alternating bilinear form; with this in mind, we 
may thus unambiguously use the notation GSp2g(fc) and Sp2g{k). Note that for g = I, GSp2(/c) = 
GL2(A;) and Sp2(A;) = SL2(A;). For any A £ GSp2g(fc), we have the relation 

P{m{A)/T)/{m{A)/T)s = P{T)/T\ 

where PiT) = det(T/ - A) £ k[T]. 
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B.2. Bounds on group orders and number of conjugacy classes. 



Lemma B.l ([Gal70]). If G is a finite group and N is a normal subgroup of G, then < 
|(G/iV)«||A^«|. □ 

Lemma B.2. Fix a prime power q. 

(i) \ Sp,g{¥,)\=qs'Yl!=M''-^)- 

(ii) I GSp2,(F,)| = {q- l)q9' Uf=i{q'' - 1) < (7^3^+^+^ 

(iii) There is a constant Kg, depending only on g, such that 

I Sp25(Fg)«| < KgqS and \ GSp2g(Fg)»| < K^q^+K 

Proof. Part (i) can be found in [Art88, Chapter III §6], with part (ii) following immediately since 
I GSp2g(Fg)| = {q — 1)1 Sp2g(Fq)|. We now consider part (iii). By Lemma B.l, it suffices to prove 

□ 



the bound for | Sp2g(Fg)''|; this follows from [LP97]. 

Lemma B.3. Let q be a prime power. 

(i) |GL2(F,)|=(?(g-l)2(g + l). 

(ii) |GL2(F,)«|=g2_i. 

(iii) For tG¥^,\{AG GL2(F,) : tr(A) = t}\ = q{q^ 

(iv) Assume q is odd. For all t G Fg and d £¥^ , 

\{A e GL2(F5) : det(A) = d,tv{A) = t}\ 



q-l). 



+ 



-Ad 



where 



is the Legendre symbol. 



Proof. One has an explicit description of the conjugacy classes of GL2(Fq), see for example [Lan02, 
XVIII Table 12.4]. The lemma is then a direct computation. □ 
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